Implementing SSL for web services

Hi,

I need to implement SSL for our web services that are deployed in Websphere on IBM i. They are called via the Apache HTTP server from our own servers. The SSL requirement is coming from our auditors. I'm having trouble figuring out where I need to turn on SSL. Do I do it in the Apache HTTP Server, do I do it in Websphere or do I need to do it in both places? This is Websphere 5.1 Express (I know it is an old version) running on a V5R4 system. We do plan to upgrade this year sometime.

Part of my confusion regarding Apache is that the documentation talks about turning on SSL for an application in Apache. In this case, I don't have an application. Apache just forwards the requests to Websphere. I am currently controlling who can call the web services by defining Locations in Apache and using Allow or Deny on ip addresses. Any ideas or pointers from anyone?

Dean Eshleman
Software Development Architect

Everence Financial
1110 North Main Street
PO Box 483
Goshen, IN 46527
Phone: (574) 533-9515 x3528
www.everence.com<http://www.everence.com/>

______________________________________________________________________
Confidentiality Notice: This information is intended only for the individual or entity named. If you are not the intended recipient, do not use or disclose this information. If you received this e-mail in error, please delete or otherwise destroy it and contact us at (800) 348-7468 so we can take steps to avoid such transmission errors in the future. Thank you.